Overview
- Security researchers say Sandworm_Mode is a self‑propagating supply‑chain worm that spreads through code repositories and developer automation to gain broad footholds in software projects.
- The malware is designed to harvest credentials, cloud keys and API tokens used by AI coding assistants and nine major LLM providers to pivot across CI/CD pipelines and cloud services.
- CrowdStrike's analysis shows the worm separates initial access from follow‑on actions by inserting multi‑day delays and hiding its actions among high volumes of legitimate dependency downloads, which shrinks defenders’ telemetry windows.
- If it cannot spread or reach its objectives the code can automatically destroy compromised build or test environments, a behavior that complicates incident response and forensic analysis.
- Analysts have not attributed the worm to a known group and say related malicious packages with similar but different patterns continue to appear, forcing security teams to prioritize hunting in noisy AI development workflows and guard against long‑term resale of access.